> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-6-network-scanning-and-port-scanning-techniques.md). # Topic 6: Network Scanning and Port Scanning Techniques ### Simple Explanation If footprinting is "watching the house from outside," scanning is "walking around and checking every door and window to see which ones are unlocked." Scanning actively probes the target to discover live hosts, open ports, running services, and the operating system. *** ### 1. What is Network Scanning? The process of identifying active hosts, open ports, and services on a network by sending crafted packets and analyzing the responses. It is the second phase of hacking, right after footprinting. #### Objectives of Scanning * Discover live systems (which IPs are actually "alive") * Discover open ports and running services on those systems * Identify the operating system and its version (OS fingerprinting) * Identify vulnerabilities associated with discovered services ### 2. TCP/IP Basics You Must Know First #### The TCP Three-Way Handshake 1. Client sends **SYN** (synchronize) to server. 2. Server replies **SYN-ACK** (synchronize-acknowledge). 3. Client replies **ACK** (acknowledge) → connection established. This handshake behavior is exploited by many scan types below. #### TCP Flags (used to craft different scan types) | Flag | Meaning | | ---- | ---------------------------------------- | | SYN | Initiate connection | | ACK | Acknowledge received data | | FIN | Finish/close connection gracefully | | RST | Reset/abort connection immediately | | PSH | Push data immediately to the application | | URG | Urgent data | #### Port States | State | Meaning | | ---------- | --------------------------------------------------------------------------------- | | Open | A service is actively listening and responding | | Closed | Port is reachable but no service is listening | | Filtered | A firewall is blocking the probe, so the state can't be determined | | Unfiltered | Port is accessible but scanner can't tell if it's open/closed (used in ACK scans) | ### 3. Types of Scans #### A. Host Discovery * **Ping Sweep (ICMP Sweep)** — sends ICMP Echo Requests to a range of IPs to see which respond (are "alive"). Fast but often blocked by firewalls that drop ICMP. * **ARP Scan** — used on local networks; more reliable than ping since ARP usually can't be blocked on a LAN. #### B. Port Scanning Techniques | Scan Type | How it Works | Stealth Level | Notes | | ------------------------ | ----------------------------------------------------------------------------------------------------------- | --------------------------- | ----------------------------------------------------------------------------------------------------------- | | **TCP Connect Scan** | Completes the full 3-way handshake | Low (easily logged) | Most reliable, but noisy — appears in application logs | | **SYN Scan (Half-Open)** | Sends SYN, receives SYN-ACK, then sends RST instead of completing handshake | High (stealthier) | Doesn't complete connection so it's less likely to be logged by the application; the classic "stealth scan" | | **FIN Scan** | Sends only a FIN flag; closed ports reply RST, open ports usually don't reply (per RFC 793) | High | Doesn't work reliably against Windows systems | | **XMAS Scan** | Sends FIN+PSH+URG flags all set (packet "lit up like a Christmas tree") | High | Same closed-port-replies-RST logic as FIN scan | | **NULL Scan** | Sends a packet with NO flags set | High | Same logic; open ports give no response, closed ports send RST | | **ACK Scan** | Sends only ACK flag | N/A (not for open/closed) | Used to map firewall rule sets — determines if a port is filtered or unfiltered, not open/closed | | **UDP Scan** | Sends UDP packets; no response = possibly open, ICMP "port unreachable" = closed | Slow, unreliable | UDP is connectionless so results are less definitive | | **Idle/Zombie Scan** | Uses a third, idle "zombie" host's IP ID sequence to scan a target without revealing the real attacker's IP | Very high (fully anonymous) | Advanced/rare technique, good exam theory question | #### Why FIN/XMAS/NULL scans can bypass simple firewalls Many basic firewalls/IDS only look for SYN packets to detect scanning attempts. Since these three scan types never send a SYN packet, they can sometimes slip past such filters — though modern firewalls/IDS usually detect them too. ### 4. Firewall/IDS Evasion Techniques (theory-heavy exam topic) * **Packet Fragmentation** — splitting packets into smaller fragments so signature-based IDS can't easily match the full pattern. * **Source Port Manipulation** — using a common port (like 53/DNS or 80/HTTP) as the *source* port to trick poorly configured firewalls into allowing the traffic. * **IP Spoofing** — sending packets with a fake source IP (though this prevents receiving a direct reply, so it's more useful for stealth than for gathering info, or for decoy scans). * **Decoy Scanning** — sending scan packets that appear to come from multiple spoofed "decoy" IPs alongside the real one, making it hard for the target to identify the true attacker. * **Randomizing scan order/timing** — slowing down scans (`-T0`/`-T1` in Nmap) to avoid triggering rate-based IDS alerts. * **Using proxies/anonymizers** — routing scan traffic through intermediate systems. ### 5. OS Fingerprinting Identifying the target's operating system based on how its network stack responds to unusual/crafted packets (since different OS TCP/IP stack implementations behave slightly differently — e.g., default TTL values, TCP window sizes, response to malformed packets). * **Active Fingerprinting** — sending crafted probe packets directly (e.g., Nmap's `-O` flag). * **Passive Fingerprinting** — analyzing normal traffic without sending anything (e.g., analyzing TTL, window size in sniffed packets) — stealthier. ### 6. Banner Grabbing Connecting to an open port and reading the "banner" — the welcome message a service sends that often reveals software name and version. * Example: connecting to port 21 (FTP) might reveal `220 ProFTPD 1.3.5 Server ready`. * Tools: `telnet `, `nc `, Nmap's `-sV` flag (version detection). * This is very valuable because once the exact software version is known, you can look up known CVEs for it. ### 7. Network Diagramming / Mapping After scanning, testers often draw a network topology diagram (showing hosts, routers, firewalls, subnets) to visualize the attack surface — using tools like Nmap's topology view or manual diagramming based on traceroute results. ### 8. Scanning Tools | Tool | Purpose | | -------------------- | ----------------------------------------------------------------------------------------------------------- | | **Nmap** | The industry-standard scanner — host discovery, port scanning, OS/version detection, scripting engine (NSE) | | **Masscan** | Extremely fast port scanner for scanning huge IP ranges | | **Hping3** | Crafts custom packets for advanced scanning/testing (can do SYN floods for testing too) | | **Angry IP Scanner** | Simple, fast GUI-based IP/port scanner | | **Zenmap** | GUI front-end for Nmap | #### Common Nmap Commands (Practical — very likely to be tested) ``` nmap -sn 192.168.1.0/24 # Ping sweep / host discovery only, no port scan nmap -sS 192.168.1.10 # SYN (stealth) scan nmap -sT 192.168.1.10 # TCP connect scan nmap -sU 192.168.1.10 # UDP scan nmap -sV 192.168.1.10 # Service/version detection nmap -O 192.168.1.10 # OS detection nmap -p 1-65535 192.168.1.10 # Scan all ports nmap -A 192.168.1.10 # Aggressive scan (OS, version, script, traceroute) nmap -T4 192.168.1.10 # Timing template (faster scan) nmap --script vuln 192.168.1.10 # Run vulnerability-detection NSE scripts ``` ### 9. Countermeasures Against Scanning * Configure firewalls to block/limit ICMP and drop unsolicited SYN packets. * Use an **IDS/IPS** (Intrusion Detection/Prevention System) to detect scanning patterns. * Close/disable unused ports and unnecessary services. * Use port knocking or VPNs to hide sensitive services from casual scanning. * Regularly audit open ports with your own scans (know your own attack surface). * Rate-limit or block IPs showing scanning behavior (many connection attempts in a short time). *** ### Exam Points (Quick Revision) * Scanning = 2nd phase of hacking; discovers live hosts, open ports, services, OS. * 3-Way Handshake: SYN → SYN-ACK → ACK. * Scan types: TCP Connect (full handshake, noisy), SYN (stealth, half-open), FIN/XMAS/NULL (flag-based stealth scans), ACK (firewall rule mapping), UDP (connectionless), Idle/Zombie (fully anonymous). * Port states: Open, Closed, Filtered, Unfiltered. * Banner grabbing reveals software + version → used to find matching CVEs. * OS fingerprinting: Active (send probes) vs Passive (observe traffic only). * Nmap flags: `-sS`, `-sT`, `-sU`, `-sV`, `-O`, `-A`, `-p`, `-T<0-5>`. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-6-network-scanning-and-port-scanning-techniques.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.